On: What NPM should do to stop a new colors attack

[xvector]

But does GitHub/NPM have the right to modify his code and publish it under his account/his name? I doubt that is legal.

[jffry → xvector]

The MIT license doesn't require NPM to list marak as the publisher of the NPM package, as long as they still obey the license's requirements.

Besides, the NPM Terms of Service are almost certainly broad enough to permit NPM to publish a modified version of a package or to delete a package.